Rock Paper Scissors

Summary

The contract contains a require(game.bet == 0) check that permits joining a game without sending ETH. This could lead to unexpected behavior or abuse if the system logic assumes players stake value for participation.

Vulnerability Details

Function:

function joinGameWithToken(uint256 _gameId) external

This allows users to join games with no ETH sent, which may:

• Bypass expected staking requirements

• Break game balance

• Allow payout logic to behave incorrectly if ETH distribution assumes a stake was made

Impact

• Unexpected reward claiming or division logic

• Potential DoS or exploits in payout routines

• Free participation in what may be intended as paid games

Tools Used

Manual review

Recommendations

Add a dual-condition check to ensure value sent matches game expectation: